fix(canopy): set KOPIA_PASSWORD env so snapshot restore can reopen the repo

The canopy restore path ran 'kopia repository connect' and 'kopia
snapshot restore' as two separate processes, passing the repo password
only to connect via --password. The restore process must reopen the
repository and needs the password again; headless containers have no
keyring for kopia to retrieve the persisted credential, so it fell back
to an interactive prompt and died with 'inappropriate ioctl for device'.

Mirror the legacy restore path by setting KOPIA_PASSWORD on the kopia
container env, which kopia reads on every invocation.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: passcod

src/controllers/canopy/builders.rs

@@ -205,11 +205,25 @@ pub fn build_canopy_restore_job(cfg: &CanopyRestoreJobConfig<'_>) -> Job {
 		args: Some(vec![script]),
 		env: Some(
 			[
-				vec![EnvVar {
-					name: "SNAPSHOT_ID".into(),
-					value: Some(cfg.snapshot_id.into()),
-					..Default::default()
-				}],
+				vec![
+					EnvVar {
+						name: "SNAPSHOT_ID".into(),
+						value: Some(cfg.snapshot_id.into()),
+						..Default::default()
+					},
+					// `snapshot restore` runs as a separate kopia process from
+					// `repository connect`, so it must re-open the repository and
+					// needs the password. Headless containers have no keyring for
+					// kopia to retrieve the persisted credential from, so without
+					// this env var it falls back to an interactive prompt and dies
+					// with "inappropriate ioctl for device". kopia reads
+					// KOPIA_PASSWORD on every invocation.
+					EnvVar {
+						name: "KOPIA_PASSWORD".into(),
+						value: Some(cfg.repo_password.into()),
+						..Default::default()
+					},
+				],
 				kopia_writable_env(),
 			]
 			.concat(),
@@ -637,6 +651,14 @@ mod tests {
 				.iter()
 				.any(|e| e.name == "SNAPSHOT_ID" && e.value.as_deref() == Some("abc123"))
 		);
+		// KOPIA_PASSWORD must be on the container env so `snapshot restore`
+		// (a separate process from `repository connect`) can re-open the
+		// repository without an interactive password prompt.
+		assert!(
+			kopia_env
+				.iter()
+				.any(|e| e.name == "KOPIA_PASSWORD" && e.value.as_deref() == Some("supersecret"))
+		);
 		let kopia_mounts = pod_spec.containers[0].volume_mounts.as_ref().unwrap();
 		assert!(
 			kopia_mounts